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Intro 


All versions of the O.MG Cable, O.MG Adapter, and the O.MG Plug are now supported by the universal v2 firmware installer. 
O.MG Cable is available at https://hak5.org/omg 
Specs: 


e Interface: USB 

e Radio: 802.11b/g/n (2.4GHz) 

e Power: 

e o Voltage: 5v (+/- 0.5v) 

e o Current: 500mA (or higher) 

e Payload: Keystroke Injection transmitted via the active end of the cable/adapter. 

e Payload Syntax: DuckyScript, with enhancements to support extra O.MG capabilities. 
e Passthrough data speed (for Cables & Adapter): USB 2.0 (480mhz) 

e Passthrough charging (for Cables & Adapter): 


© All devices are compatible only with 5v USB power sources. 


e o Additionally, USB PD sources are supported by O.MG devices with active ends that are Type C. The active end needs 
to be connected to the charge source, and 5v will be automatically negotiated by the O.MG device. 


e o The active end must be connected to the charge source for passthrough charging to work. 


© By design, USB hosts are intended to be the charge source. However, you can utilize battery/wall charge sources if all 
the above requirements are met. Failure to follow the above will risk damage to the O.MG Cable. 


e Capacity: ~650,000 keystrokes of storage (for models with Keylogger) 
Keyboard Support: USB Full Speed keyboards. (Full Speed USB = 12 Mbps) Details & tested keyboards are listed here 


Initial Setup & Using your O.MG Device 


O.MG Devices requires an initial firmware installation. After that, all controls happen inside the Web UI, which includes payload 


syntax documentation and example payloads. 
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The process is simple: 


1. Use the O.MG Programmer to flash your O.MG Device with the latest firmware (see detail instructions below) 
2. Connect to the Web UI (see detail instructions below) 


3. Once in the Web UI, the Help Menu contains a complete list of payload syntax. Also, see the example payloads (under the 
Load menu) for more ideas. 


4. Read the Troubleshooting & Support section below if you run into issues. 


Flash the O.MG Device 


Flashing - Easy Way 


1. Just go to the O.MG Web Flasher and follow the directions. 
The final page will remind you that the default network is SSID: O.MG Pass: 12345678 


Note: This only works with browsers that support web-serial like Chrome, and you still need the driver for the programmer 
installed. 


If the O.MG Web Flasher is not working for you, or you would like more control, please use the python flasher in the Advanced 


flashing section below. 


Flashing - Advanced 


If the Web Flasher does not work for your needs, or you would like more control than the Web Flasher allows, you can utilize 
our python flasher. This allows fully offline flashing of firmware, ability to customize the wifi settings while flashing, bulk 


flashing, creating backups, and factory resets. 


Advanced Flashing Instructions 


Connect to the O.MG Web UI 


First, unplug the O.MG Device from the programmer and plug the active end into a USB port on a USB Host device. (Ex: For * 
to A devices, the active end is the Type A connector. For * to C devices, the active end is the Type C connector). 


Then connect your controlling device to the wireless network, and browse to the O.MG's IP address as follows: 


e If in Access Point mode, you can connect to the SSID (Default SSID: O.MG, PASS: 12345678) and then the O.MG Device 
will be accessible via http://192.168.4.1. Note: custom SSID/PASS can be set in the python flasher, or configured after 
flashing via the WebUI. 
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e If in Station mode, the O.MG Device connects as a client and will be available via http://whatever-|P-your-network- 
assigns-the-device (ex http://192.168.1.123). To find the IP, will have to check the DHCP leases assigned on your network, 
or use other methods of enumerating new devices on your network. If your network supports it, you can also connect via 
http://OMG_LASTSIXOFMACID. local. (ex: http://OMG_D1361A.local) Note: Station Mode can only be configured via the 
python flasher, or configured after flashing via the WebUI. The network must support 2.4Ghz. 


Modes & Features 


Elite Features 


The new Elite features are currently in development as part of the Early Access availability and will only be available in v3 (beta) 
firmware. v3 firmware is currently planned for feature completion and promotion to "stable" during 2023. If you have an Elite 
model, when flashing your cable with the Web Flasher, choose the beta firmware branch to get the latest version of these 
features. You can also use the stable firmware branch if you want, but it will not have the newest features. Discussion, testing, 
and latest info around these features will happen inside the #beta-firmware-testing channel on our discord. 


For further detail on using currently available v3 beta features, see the Wiki Article: Elite Early Access 
Payloads 


Keystroke Injection 


The O.MG Devices have an enhanced version of DuckyScript. Most existing ducky payloads work, plus we have added extra 
features that are made possible by O.MG hardware. You can find a full list of script syntax inside the Web UI under the Help 
menu. If you are looking for an explainer on what Keystroke Injection attacks are, and the basics of DuckyScript, Hak5 has a 
great rundown here. 


Example Payloads 


We have included some basic Example Payloads in the Web UI, which are meant to give you a general idea on how to structure 
your own payloads. The example payloads can be found under the Help menu. There is also a public repository for OMG 
payloads here: https://github.com/hak5/omg-payloads. In the Hak5 / O.MG Discord Community, we also have channels for 
members to share tips and tricks around developing their own payloads. 


Executing Payloads 


Payloads can be executed directly from the Web UI, just click run! You can also save and load payloads to the multiple slots 
inside the O.MG Device's flash storage. Additionally, the boot slot is a special payload slot that is executed every time the 
O.MG Device is powered on (which happens each time it is plugged into a USB port). 


Knowing the Active End 


Payloads are transmitted out the active end of the O.MG Device. The active end is also the end you connect to the O.MG 


Programmer when flashing your O.MG Device. For * to USB A cables, the active end is the USB A connector. For * to USB C 
cables and the O.MG Adapter, the active end is the USB C connector. The Directional C to C cable has the active end of the 
cable marked with a USB logo. 


Keylogger 


If you have an O.MG Device with added keylogger functionality, the Web UI will display an additional tab for keylogging. To 
successfully keylog, you need to physically connect the O.MG Device between the keyboard you want to log and the device the 
keyboard is attached to. Keylogging on O.MG Cable was designed specifically for keyboards with detachable cables. The O.MG 
Adapter is designed for keyboards with permanent or detachable cables. The active end of the O.MG Cable must connect to 
the USB host, while the other end is connected to the physical keyboard. 


Most keyboards are Full Speed (12mbps) USB. We currently support capture of Full Speed USB keyboards. Keyboards that have 
been tested as working by the customer community include: Apple Magic Keyboard, Razer Blackwidow Lite (RZ03-0264), 
Microsoft Sculpt Ergo, Corsair K93 Wireless Entertainment Keyboard, Dierya DK63, Reddragon K588, Keychron K1, Keychron K6, 
E-YOOSA Super Scholar/Z-88, Fingerworks TouchStream MacNTouch, Drop CTRL Mechanical Keyboard, Brydge C-Type 


Mobile Payloads 


If your O.MG Device includes USB-C Smartphone & Tablet Keystroke Injection (O.MG Devices with an active USB-C connector), 
then deploying payloads against a smartphone or tablet is easy. Plug only the active USB-C end into a smartphone or tablet. 
No other steps are needed, the payload delivery will automatically work just like with host attacks. Check out the video and 
payload for Android Reverse Shell if you are looking for ideas on how to experiment with mobile payloads. 


Directional Cable 


The Directional O.MG Cable is different than the other O.MG Cables. Instead of being built for covert field deployments, the 
Directional O.MG Cable is designed for demos, training, and attacker deployed scenarios. Officially, there are 8 types of USB-C 
to USB-C cables a consumer can have. The O.MG C to C Directional cable is none of them! We exploit the Type C design 
specifications in a way that allows the cable's behavior to change depending on what direction you plug it in. 


As with all O.MG Cables: the active end deploys payloads and the active end must be connected to a USB Host for charging to 
work. If your demo uses a non-USB Host charge source (ex: wall charger or battery charge source), you MUST ensure it ONLY 
outputs 5v. Failure to obey this will likely damage the O.MG Cable AND the device you plug in. 


Support 


If you have read all of the above and are still experiencing problems, please join the #omg-support channel in Hak5 Discord to 
chat with the O.MG developers and customers who are familiar with the O.MG products. 
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